The c-Differential-Linear Connectivity Table of Vectorial Boolean Functions

Vectorial Boolean functions and codes are closely related and interconnected. On the one hand, various requirements of binary linear codes are needed for their theoretical interests but, more importantly, for their practical applications (such as few-weight codes or minimal codes for secret sharing, locally recoverable codes for storage, etc.). On the other hand, various criteria and tables have been introduced to analyse the security of S-boxes that are related to vectorial Boolean functions, such as the Differential Distribution Table (DDT), the Boomerang Connectivity Table (BCT), and the Differential-Linear Connectivity Table (DLCT). In previous years, two new tables have been proposed for which the literature was pretty abundant: the c-DDT to extend the DDT and the c-BCT to extend the BCT. In the same vein, we propose extended concepts to study further the security of vectorial Boolean functions, especially the c-Walsh transform, the c-autocorrelation, and the c-differential-linear uniformity and its accompanying table, the c-Differential-Linear Connectivity Table (c-DLCT). We study the properties of these novel functions at their optimal level concerning these concepts and describe the c-DLCT of the crucial inverse vectorial (Boolean) function case. Finally, we draw new ideas for future research toward linear code designs.


Introduction
Vectorial Boolean functions are intensively used to produce S-boxes in block ciphers such as DES [1], Rinjdael or AES [2], Blowfish [3], GOST [4], and Serpent [5].Various criteria have been proposed to test the resistance of S-boxes and the corresponding vectorial Boolean functions to known cryptanalytical attacks, such as the differential attack [6], the linear attack [7], and some of their variants.
Let F : F 2 n → F 2 m be a (n, m)-vectorial Boolean function.The derivative of F in the direction of a ∈ F 2 n is the function D a (F)(x) = F(x) + F(x + a).The derivative is used to analyse the resistance of a vectorial Boolean function to the differential attack [6] and serves to build the Differential Distribution Table (DDT).The derivative is also used in the Boomerang Connectivity Table (BCT) [8] and in the Differential-Linear Connectivity Table (DLCT) [9,10].The entry at (a, b) ∈ F 2 n × F 2 m of the DDT is defined by The most resistant vectorial Boolean functions have small differential uniformities.The reader can consult the [12] for a complete background on vectorial Boolean functions with a deep analysis of their cryptographic aspects.
At FSE 2002, Borisov et al. [13] proposed a variant of the differential attack to study ciphers' resistance based on using modular multiplication as a primitive operation.This motivated Ellingsen et al. [14] to introduce the concept of c-differentials to study the resistance of a vectorial Boolean function to multiplicative variants of the differential attack.For a vectorial Boolean function F : F 2 n → F 2 m and c ∈ F 2 m , the c-derivative F with respect to a ∈ F 2 n is the (n, m)-vectorial Boolean function c D a F defined by c D a F(x) = F(x + a) + cF(x) for all x ∈ F 2 n .The c-derivative is used to study the resistance of ciphers based on popular vectorial Boolean functions such as the inverse function [15], the Gold function [16], and various other functions [17][18][19][20][21].As for the DDT, a c-differential table was proposed in [14], where the entry at (a, b) ∈ F 2 n × F 2 m is defined by Also, a c-differential uniformity was proposed in [14] by The construction of functions, particularly permutations, with low c-differential uniformity is an interesting problem, and recent work has focused heavily on this direction.Likewise, regarding the original notion of differential uniformity leading to optimal functions Perfect Nonlinear (PN) and Almost Perfect Nonlinear (APN) over finite fields in odd and even characteristics, respectively, optimal functions having the lowest possible values of a c-differential uniformity have also been introduced.One can refer to [19,[22][23][24][25][26][27] and the references therein.Some of those functions with low c-differential uniformity have been investigated.There are relatively few known (non-trivial, nonlinear) optimal classes of PcN and APcN functions over finite fields with an even characteristic (see, e.g., [18,[28][29][30][31] and the references therein).
Another popular cryptanalysis attack on S-boxes derived from Boolean functions is the boomerang attack, proposed by Wagner [32] in 1999.In connection with the boomerang attack, Cid et al. [8] proposed the Boomerang Connectivity Based on the BCT, Boura and Canteaut [33] introduced the boomerang uniformity of a vectorial Boolean function to measure its resistance against boomerang attack.The boomerang uniformity of F is defined by To extend the BCT and the boomerang uniformity of a vectorial Boolean function, Stǎnicǎ [34] introduced the concept of the c-Boomerang Connectivity Table ( The corresponding c-boomerang uniformity is defined by More generalizations of the differential and boomerang uniformities can be found in [35].
Entropy 2024, 26, 188 3 of 17 In 2019, Bar-On et al. [10] (see also [9]) introduced the Differential-Linear Connectivity where x • y is the inner product of x and y on F 2 m .To measure the resistance of an S-box connected to a vectorial Boolean function, the differential-linear uniformity of F can be used, as defined by Li et al. in [36], Various links exist between the DLCT and the Autocorrelation The corresponding absolute indicator is defined as In [37], Canteaut et al. showed that the DLCT and the ACT of a vectorial Boolean function satisfy

•
The c-autocorrelation of a vectorial Boolean function: The absolute indicator is and the autocorrelation spectrum is • The c-Differential-Linear Connectivity Table (c-DLCT) where we use the c-derivative: We also define the c-differential-linear uniformity of F as and, also, we define the c-DLCT spectrum of F by We show that there are numerous relationships between the three new concepts.Typically, we show that . Moreover, we focus on the inverse function defined on F 2 n by F(x) = 1 x if x ̸ = 0, and F(0) = 0. We study its c-DLCT and give an explicit value for the entries, including when c = 1.
We mention that there is an interesting connection between c differential uniformity and combinatorial designs, which has been highlighted in [38] by showing that the graph of a perfect c-nonlinear function (an optimal function concerning the c differential uniformity) is a set of differences in a quasigroup.Difference sets give rise to symmetric designs, which are known to build optimal self-complementary codes.Some types of designs also have concrete applications such as secret sharing and visual cryptography.
Finally, we emphasise that one of our practical applications in brother research lines is to use the derived (optimal) functions (see, e.g., [12]) to derive minimal binary linear codes (see, e.g., [39]) that are needed for their theatrical interests but, more importantly, for their practical applicants such as few-weight codes or minimal codes for secret sharing and securing two-party computation.
The rest of this paper is organized as follows.Section 2 presents some known results that will be used in this paper.In Section 3, we define the c-Walsh and the c-autocorrelation of a vectorial Boolean function and study some of their properties.In Section 4, we present the concept of the c-DLCT and study its properties.We investigate the c-DLCT of the inverse function in Section 5. Finally, Section 6 concludes the paper and presents new ideas for future research toward linear code designs along the same lines as designing (minimal) codes from Almost Perfect Nonlinear (APN) and recent achievements [40] on minimal codes from low differential uniformity.

Preliminaries
In this section, we present some results and definitions that will be used in the next sections, including the c-derivative and the c-differential uniformity of a vectorial Boolean function.
For b ∈ F 2 n , we define the orthogonal space b ⊥ of b as follows.
where b • x is the inner product of b and x on F 2 n .
The following result gives an explicit value for #b ⊥ .
Suppose that b j = 1 for some j with 0 For n ≥ 1, let F 2 n be the finite field with 2 n elements.The trace of an element x ∈ F 2 n is given by and satisfies Tr(x) ∈ {0, 1}.The trace function satisfies Tr(x 2 ) = Tr(x) for all x ∈ F 2 n .The following lemma is well known and is useful for our work.

Lemma 1.
Let n and k be positive integers and e = gcd(k, n).Then, Some specific equations on F 2 n may be involved.The following result deals with the quadratic equation.
In [14], Ellingsen et al. proposed the concept of c-differentials.The following definitions are valid for binary finite fields.

The c-Walsh and c-Autocorrelation of a Vectorial Boolean Function
The Walsh transform of a Boolean function f : where u • x is the inner product of u and x.The Walsh transform serves to compute the linearity of f as For a vectorial Boolean function and is used to compute the linearity of F by We extend the Walsh transform of a vectorial Boolean function to the c-Walsh transform as follows.
The autocorrelation function is used to study various properties of the Boolean functions (see [42]).Definition 6.Let f be Boolean function defined on F 2 n .The autocorrelation of f at u ∈ F 2 n is the integer and its absolute indicator is ∆ f = max u∈F 2 n ,u̸ =0 AC f (u) .
We notice that u = 0 is excluded in the definition of the absolute indicator since AC f (0) = ∑ x∈F 2 n (−1) f (x)+ f (x) = 2 n .The generalization of the autocorrelation to vectorial Boolean functions can be then defined as follows.
Definition 7. Let F be an (n, m)-vectorial Boolean function defined on F 2 n .The autocorrelation of The absolute indicator is and the autocorrelation spectrum is The trivial values are not considered in the definition of the absolute indicator since Inspired by Definition 6, we introduce the notion of c-autocorrelation of a Boolean function.

The absolute indicator is
and the autocorrelation spectrum is To ease the study of the c-autocorrelation of a vectorial Boolean function F, we present its c-autocorrelation The following result links the c-autocorrelation of a vectorial Boolean function and its c-Walsh transform.Proposition 2. Let F be an (n, m) Boolean function.Then, for any u ∈ F 2 n and any v ∈ F 2 n , Proof.We have This finishes the proof.

The c-Differential-Linear Connectivity Table of a Vectorial Boolean Function
In this section, we present a new concept, called the c-Differential-Linear Connectivity Table (c-DLCT), which generalizes the standard DLCT, independently defined in 2018 by Kim et al. [9] and Bar-On et al. [10] We start by defining the standard Differential-Linear Connectivity The DLCT is a tool that could analyse the relationships between differential and linear parts of a block cipher.One can observe that if This induces the following definition for differential-linear connectivity uniformity.Definition 11.Let F be an (n, m)-vectorial Boolean function.The differential-linear connectivity uniformity of F is The DLCT of a vectorial Boolean function is related to the autocorrelation function by the following relation.
The DLCT is a tool to study the relationships between the linear and the differential properties of a block cipher.For (u, v) ∈ F 2 n × F 2 m , it counts the number of elements Moreover, the c-differential-linear connectivity uniformity of F is and the c-DLCT spectrum of F is defined for From Definitions 9 and 12, we obtain the following connection between the c ACT and the c DLCT of a vectorial Boolean function.
Proof.We have which gives c DLCT F (u, v) = 1 2 c AC F (u, v).On the other hand, we have and c γ F = 1 2 c ∆ F .This finishes the proof.
As a consequence of the former proposition, the following result connects the c-DLCT and the c-derivative of a vectorial Boolean function via the Walsh transform.
Proof.Combining Definition 2 and the definition of the Walsh transform, we obtain Then, using Proposition 3, we have The following result shows a connection between the c-DLCT and the c-derivative of a vectorial Boolean function via the Walsh transform.Proposition 5. Let F be an (n, m)-vectorial Boolean function, and c ∈ F 2 m , c ̸ = 0.Then, for any Proof.Combining Proposition 2 and Proposition 5, we obtain as claimed.
The following result gives a link between c DLCT F and c ∆ F (a, b).Proposition 6.Let F be an (n, m)-vectorial Boolean function, and c ∈ F 2 m , c ̸ = 0.Then, for any Proof.By Proposition 3, we have This leads to which finishes the proof.

The c-DLCT of the Inverse Function
In this section, we give the explicit values of the entries of the c-DLCT, including the case c = 1, and give some numerical results on F 2 n with 3 ≤ n ≤ 8.

The 1-DLCT of the Inverse Function
For c = 1, the 1-DLCT satisfies the following result.Theorem 1.Let F : F 2 n → F 2 n be the inverse function defined by F(0) = 0, and F(x) = x2 n−2 for x ̸ = 0.For a, b ∈ F 2 n , define the set where b ⊥ is the orthogonal space of b.Then, Proof.We use the definition Hence, x = a is a solution of the Equation (1) if and only if1 a ∈ b ⊥ .Case 3.3.Suppose that x ̸ = 0 and x ̸ = a.We have Case 3.3.1.If z = 0, then the Equation (2) reduces to a = 0, which is not possible.Case 3.3.2.Suppose that z ̸ = 0.If Tr 1 az = 1, then, by Lemma 2, the Equation (2) has no solution, and if Tr 1 az = 0, it has two solutions.Define the set which finishes the proof.

The c-DLCT of the Inverse Function for c ̸ = 1
Theorem 2. Let F : F 2 n → F 2 n be the inverse function defined by F(0) = 0, and Proof.Suppose that c ̸ = 0 and c ̸ = 1.We use the definition We consider the following cases.Case 1. Suppose that b = 0.Then, for all Hence, x = a is a solution of the Equation (3) if and only if c a ∈ b ⊥ .Case 3.3.Suppose that x ̸ = 0 and x ̸ = a.We have To summarize all the cases, we define the set which finishes the proof.

Numerical Results for the c-DLCT of the Inverse Function
We have computed the c-DLCT of the inverse function over F 2 n for 3 ≤ n ≤ 7, and all c ∈ F * 2 n , while for n = 8, we only compute it for c = 1, 2, . . ., 10.The inversion and multiplication in F 2 n are processed modulo the polynomials presented in Table 1.
In Table 2, we present the values of c DLCT F (u, v) of the inverse function over F 2 4 with c = 0 × 9.
For the inverse function over F 2 n , we present in Table 3 the c-DLCT spectrum c Γ F and c-differential-linear uniformity c γ F for 3 ≤ n ≤ 8 and for small values of c.All the other c-DLCT spectrums reduce to one of the listed ones in the table.
Table 3.The c-DLCT spectrum and the c-differential-linear connectivity uniformity of the inverse function over F 2 n for 3 ≤ n ≤ 8 and small c.

Conclusions
In this paper, we introduced and studied new cryptographic tools and parameters to help us quantify the security of S-boxes (mathematically, vectorial Boolean functions) involving block ciphers as main components: the c-Walsh transform, the c-autocorrelation, and the c-differential-linear uniformity.We also introduced a new table called the c-Differential-Linear Connectivity Table (c-DLCT) to analyse attacks related to the differential and the linear attacks.We considered various S-box family properties associated with the above-mentioned notion and presented the values of the c-DLCT of the particular crucial case of the inverse function.Finally, recall that codes over finite fields have been studied extensively because of their linear structures and practical implementations.It is the basis of the research on various kinds of codes.One well-known construction method of linear codes is derived from special functions (essentially from cryptographic functions which play a crucial role in symmetric cryptography) over finite fields (see the book [12]).Cryptographic multi-output Boolean functions and codes have essential data communication and storage applications.These two areas are closely related and have had a fascinating interplay (see, e.g., the book chapter in [43] and the references therein).Cryptographic functions and linear codes are closely related and have had a fascinating interplay.Cryptographic functions (e.g., highly nonlinear functions, Perfect Nonlinear (PN), Almost Perfect Nonlinear (APN), Bent, Almost Bent (AB), and Plateaued) have essential applications in coding theory.For instance, Perfect Nonlinear (APN or PN) functions have been employed to construct optimal linear codes (see, e.g., [44][45][46][47][48] and the references therein).Very recently, Mesnager, Shi, and Zhu [40] proposed several constructions of minimal (cyclic) codes from low differential uniform functions.Given these works, the derived functions from this paper would help design new families of binary minimal codes.We will keep an in-depth study of them in future work and cordially invite interested readers to investigate them.
of a Boolean function F is used in various tables, such as the DDT, the BCT, and the DLCT.Motivated by the crucial role of the derivative in the former tables and the attacks related to them, we propose three new concepts towards the c-derivative c D a (F)(x) = F(x + a) + cF(x): • The c-Walsh transform of a vectorial Boolean function F: For c ∈ F * 2 m , it is defined for a ∈ F 2 n and b ∈ F 2 m by c W F (a, b) = ∑ x∈F 2 n (−1) a•x+b•cF(x) .

Lemma 2 .Lemma 3 .
(Proposition 1 of [41]) Let a, b, c ∈ F 2 n .The equation ax 2 + bx + c = 0 has (i) One root if and only if b = 0. (ii) Two roots if and only if b ̸ = 0 and Tr ac b 2 = 0. (iii) No root if and only if b ̸ = 0 and Tr ac b 2 = 1.The following lemma concerns another equation on F 2 n .Let k and n be positive integers such that k < n.Let d = gcd(k, n), m = n d > 1, and

Definition 5 .
Let F be an (n, m)-vectorial Boolean function, and c ∈ F * 2 m .The c-Walsh transform of F is defined for u

Definition 8 .Definition 9 .
Let f be the Boolean function defined on F 2 n , and c ∈ F 2 m , c ̸ = 0.The c-autocorrelation of f at u ∈ F 2 n is the integerc AC f (u) = ∑ x∈F 2 n (−1) f (x+u)+c f (x) ,and the c-absolute indicator is c ∆ f = max u∈F 2 n AC f (u) .Similarly, to generalize Definition 7, we define the c-autocorrelation of a vectorial Boolean function.Let F be an (n, m)-vectorial Boolean function defined on F 2 n , and c ∈ F 2 m , c ̸ = 0.The c-autocorrelation of F at

Definition 12 .
and b ∈ F 2 m , b ̸ = 0, be two fixed non-zero elements.It is possible to study the relationships between the linear and the differential properties of a block cipher by studying the number of solutions of the equation v • (aF(x + u) + bF(x)) = 0 or equivalently v • (F(x + u) + cF(x)) = 0, where c = a b .This leads us to define a function's c-Differential-Linear Connectivity Table (c-DLCT).Let F be an (n, m)-vectorial Boolean function, and c ∈ F 2 m , c ̸ = 0.The c-DLCT of F is an 2 n × 2 m table where the entry at

Proposition 4 .
Let F be an (n, m)-vectorial Boolean function, and c ∈ F 2 m , c ̸ = 0.Then, for any
Table (BCT) for a vectorial Boolean function where the entry at

Table (
DLCT) of a vectorial Boolean function where the entry at Table (ACT) of a vectorial Boolean function F. The ACT is defined at

Table 1 .
The polynomials of F 2 n for 3 ≤ n ≤ 8.

Table 2 .
The values of c DLCT F (u, v) of the c-DLCT of the inverse function over F 2 4 for c = 0 × 9.